The unique properties of PUFs provide several advantages to cryptographic constructions. In general, PUFs may provide some or all of three main advantages: (1) eliminating private key storage, (2) providing tamper detection, and (3) establishing a hardware root-of-trust. Private key storage can be eliminated by evaluating a PUF to dynamically regenerate a value unique to an identified piece of hardware having that PUF. As to tamper detection, a PUF's unclonable properties (e.g., wire delays, resistance) may be such that modification to the PUF irreversibly alters the PUF's mapping from challenges (inputs) to responses (outputs) after enrollment (however, not against malicious modifications before enrollment, e.g., Becker et al., “Stealthy Dopant-Level Hardware Trojans,” Cryptographic Hardware and Embedded Systems—CHES 2013, volume 8086 of Lecture Notes in Computer Science, pages 197-214, Springer, 2013). These PUF properties may be used to produce a hardware-unique, tamper-protected value from which a hardware root-of-trust can be established.
Literature on physical unclonable functions evaluates the properties of PUF hardware design (e.g., Gassend et al., “Silicon Physical Random Functions,” Proceedings of the 9th ACM conference on Computer and communications security, CCS '02, pages 148-160, ACM, 2002; Katzenbeisser et al., “PUFs: Myth, Fact or Busted? A Security Evaluation of Physically Unclonable Functions (PUFs) Cast in Silicon,” Cryptographic Hardware and Embedded Systems—CHES '12, pages 283-301, Springer, 2012; Ravikanth, Physical one-way functions, Ph.D. thesis, 2001; Rührmair et al., “Applications of High-Capacity Crossbar Memories in Cryptography,” IEEE Trans. Nanotechnol., volume 10, no. 3:489-498, 2011; Suh et al., “Physical Unclonable Functions for Device Authentication and Secret Key Generation,” Proceedings of the 44th annual Design Automation Conference, DAC '07, pages 9-14, ACM, 2007; Yu et al., “Recombination of Physical Unclonable Functions,” GOMACTech, 2010), provides formal theoretical models of PUF properties, and designs protocols around those definitions (cf. Armknecht et al., “A Formalization of the Security Features of Physical Functions,” Proceedings of the 2011 IEEE Symposium on Security and Privacy, SP '11, pages 397-412, IEEE Computer Society, 2011; Brzuska et al., “Physically Uncloneable Functions in the Universal Composition Framework,” Advances in Cryptology—CRYPTO 2011—31st Annual Cryptology Conference, volume 6841 of Lecture Notes in Computer Science, page 51, Springer, 2011; Frikken et al., “Robust Authentication using Physically Unclonable Functions,” Information Security, volume 5735 of Lecture Notes in Computer Science, pages 262-277, Springer, 2009; Handschuh et al., “Hardware Intrinsic Security from Physically Unclonable Functions,” Towards Hardware-Intrinsic Security, Information Security and Cryptography, pages 39-53, Springer, 2010; Kirkpatrick et al., “PUF ROKs: A Hardware Approach to Read-Once Keys,” Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, ASIACCS '11, pages 155-164, ACM, 2011; Paral et al., “Reliable and Efficient PUF-based Key Generation using Pattern Matching,” IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), pages 128-133, 2011; Rührmair et al., “PUFs in Security Protocols: Attack Models and Security Evaluations,” 2013 IEEE Symposium on Security and Privacy, volume 0:286-300, 2013; van Dijk et al., “Physical Unclonable Functions in Cryptographic Protocols: Security Proofs and Impossibility Results,” Cryptology ePrint Archive, Report 2012/228, 2012; Wu et al., “On Foundation and Construction of Physical Unclonable Functions,” 2010; Yu et al., “Lightweight and Secure PUF Key Storage using Limits of Machine Learning,” Proceedings of the 13th international conference on Cryptographic Hardware and Embedded Systems, CHES '11, pages 358-373, Springer, 2011).
Prior art PUF-based protocols fall into two broad categories: (1) a simple challenge-response provisioning process like the one described below in Protocol 3, or (2) cryptographic augmentation of a device's PUF response such that the raw PUF output never leaves the device. These approaches may require external entities to handle auxiliary information (e.g., challenges and their associated helper data) that is unsupported or superfluous in existing public key cryptography standards, and/or involve a hardware device authenticating to a challenge applied during an initial enrollment process, and/or are premised on the hardware device always recovering essentially the same response to a given challenge.
While a given challenge-response pair reflects the hardware state of a device when the pair was collected, the device will age and its hardware state drift over time. As the PUF hardware ages, the number of errors present in the responses may increase. Maiti et al. (“The Impact of Aging on an FPGA-Based Physical Unclonable Function,” International Conference on Field Programmable Logic and Applications (FPL), pages 151-156, 2011) study the effects of simulated aging on PUF hardware by purposefully stressing the devices beyond normal operating conditions. By varying both temperature and voltage, the authors were able to show a drift in the intra-PUF variation that, over time, will lead to false negatives. Maiti et al. note that the error drift strictly affected the intra-PUF error rate distribution tending towards the maximum entropy rate of 50%. After enough time elapses, the hardware device may no longer be able to recover the proper response for the enrolled challenge.
For example, assume that a specific challenge ci is issued to a device during enrollment, with the device returning a public token {commitmenti, helperi} that links the device's hardware identity with the challenge c. To be authenticated, the device uses the pair {ci, helperi} to recover its private identity pipriv. As shown in FIG. 10, over time the PUF hardware may reach a time (e.g., at time τ=5 in the example of FIG. 10, which for simplicity assumes a drift that occurs linearly over time) at which hardware aging has increased the errors beyond the device's error correction limit, and the device is no longer able to reliably regenerate its private key.
Kirkpatrick et al. (“Software Techniques to Combat Drift in PUF-based Authentication Systems,” Workshop on Secure Component and System Identification, 2010) describe a method for detecting hardware aging drift, and responding by updating the device's challenge-commitment pair stored on an external server. This approach requires that the server maintain auxiliary information in the form of challenge-commitment pairs, however, and that a periodic protocol be executed between the server and the device.
Another challenge facing PUF-based systems is side channel attacks, which seek to observe and analyze auxiliary environmental variables to deduce information about the sensitive PUF output. For example, electromagnetic (EM) analysis (e.g., Merli et al., “Semi-invasive EM Attack on FPGA RO PUFs and Countermeasures,” Proceedings of the Workshop on Embedded Systems Security, WESS '11, pages 2:1-2:9, ACM, 2011; Merli et al., “Side-Channel Analysis of PUFs and Fuzzy Extractors,” Trust and Trustworthy Computing, volume 6740 of Lecture Notes in Computer Science, pages 33-47, Springer, 2011; Schuster, Side-Channel Analysis of Physical Unclonable Functions (PUFs), Master's thesis, Technische Universitat Munchen, 2010) extracts PUF output bits by observing changing EM fields during device operation. Another side channel attack methodology is (simple or differential) power analysis (e.g., Karakoyunlu et al., “Differential template attacks on PUF enabled cryptographic devices,” IEEE International Workshop on Information Forensics and Security (WIFS), pages 1-6, 2010; Kocher et al., “Introduction to Differential Power Analysis,” Cryptography Research, Inc., 2011; Kocher et al., “Differential Power Analysis,” Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology, CRYPTO '99, pages 388-397, Springer, 1999; Rührmair et al., “Power and Timing Side Channels for PUFs and their Efficient Exploitation,” 2013), where power traces are collected from a device and analyzed to extract sensitive information (e.g., PUF output bits). Over many observations of a device recovering essentially the same response to a fixed challenge, an adversary can discover the sensitive PUF output.
While it is known that the effectiveness of side channel attacks may in some systems be reduced by introducing randomness (Coron, “Resistance Against Differential Power Analysis For Elliptic Curve Cryptosystems,” Cryptographic Hardware and Embedded Systems, volume 1717 of Lecture Notes in Computer Science, pages 292-302, Springer, 1999), disguising sensitive values in this way may leave some vulnerability since the underlying values remain static and/or introduce additional complexity and/or processing overhead.